Privacy Policy

Synapse Games ("Synapse", "we", "us") is operated by Descobrilança Unipessoal LDA, a company registered in Portugal under NIPC 516940503, with its registered office at R. 2 da Matinha, 5D, 1950-326 Lisboa, Portugal. We are the data controller for the personal data described in this policy. You can reach us at info@synapsegames.one.

The daily challenge and the free exercises on the home page work without an account. Every visit, with or without an account, loads Google Analytics and the Meta Pixel and records the product analytics described in section 3(d) and 3(e), in addition to the technical server logs described in section 3(f).

(a) Account data — your email address, display name, account creation date, last sign-in date and email confirmation status. Your password is stored only as a salted hash by our authentication provider and is never visible to us. If you sign in with Google, we receive your email address and basic profile information from Google.

(b) Training data — for each completed session: the number of correct answers, the total number of questions, accuracy, experience points, the duration of the session, your answer choices and the completion timestamp.

(c) Security data — a record of failed sign-in attempts (email address, timestamp, counter) used to lock accounts against password guessing.

(d) Product analytics — on every visit: which pages you view, which exercises you start and complete, which steps of sign-up you reach, your approximate device type, and the campaign parameters (UTM) of the link you arrived through. We record this in our own database and through Google Analytics, provided by Google Ireland Limited, which sets the cookies _ga and _ga_*.

(e) Advertising data — on every visit: the Meta Pixel, provided by Meta Platforms Ireland Limited, records that you visited the site and which of the events above occurred, sets the cookie _fbp, and may associate that with your Facebook or Instagram account if you have one.

(f) Technical data — IP address, browser and operating system version and request timestamps in server logs, and error reports if the application crashes.

To create and run your account and to save your progress across devices — performance of a contract with you (Art. 6(1)(b) GDPR).

To protect accounts against password guessing and abuse — our legitimate interest in the security of the service (Art. 6(1)(f) GDPR).

To keep the service running and to diagnose faults — our legitimate interest in a working product (Art. 6(1)(f) GDPR).

To measure our audience and how the product is used, and to measure and improve our advertising — through Google Analytics and the Meta Pixel, which load on every visit.

We do not make automated decisions with legal or similarly significant effects about you, and we do not sell personal data.

Synapse is an educational and entertainment product. The scores, accuracy figures and experience points it produces are not a cognitive, psychological or medical assessment. We never use them to profile you, to draw conclusions about your abilities or your health, or to target advertising.

We use the following processors, each under a data processing agreement:

Supabase — database, authentication and storage of your account and training data.

Lovable — application hosting and error telemetry.

Meta Platforms Ireland Limited — audience measurement and advertising through the Meta Pixel, loaded on every visit.

Google Ireland Limited — audience measurement through Google Analytics, loaded on every visit, and sign-in if you choose to sign in with Google.

Some of these providers, including Google and Meta, may transfer data outside the European Economic Area.

We do not share your data with data brokers, and we never share the content of your answers with advertisers.

Account and training data: until you delete your account. Deleting your account removes your profile and your entire session history immediately and permanently.

Failed sign-in records: 30 days.

Product analytics events: 14 months.

Server logs: up to 30 days.

Google Analytics and Meta Pixel data: according to Google's and Meta's own retention rules.

You have the right to access your data, to correct it, to erase it, to restrict or object to its processing, and to receive it in a portable format.

Two of these you can exercise yourself, immediately and without asking us: on the Account page you can download everything we hold about you as a file, and you can delete your account and all of its data.

For anything else, write to info@synapsegames.one. We answer within one month.

If you believe we are handling your data unlawfully, you may lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority, at www.cnpd.pt.

Synapse is suitable for a general audience, including children, and we have designed it so that a child can use it without giving us anything: the daily challenge and the free exercises need no account.

We do not knowingly create accounts for children under 13.

The age of digital consent varies across the European Union between 13 and 16; in Portugal it is 13. If you are below that age in your country, you may create an account only with the permission of a parent or guardian, and we ask you to confirm this when you register.

We do not profile children, we do not use their training data for advertising, and we do not direct advertising at users we know to be children.

A parent or guardian may write to info@synapsegames.one at any time to see or delete a child's account and data. We act on such requests without asking the child for anything.

Passwords are stored as hashes by our authentication provider. Access to account and training data is restricted at the database level by row-level security policies, so one user cannot read another user's data. Administrative access is limited to named administrators. All traffic is encrypted in transit.

We will publish any change on this page and update the date at the top.